In Ubuntu Server and other systemd-based Linux distributions, systemd-pcrphase.service (along with its associated systemd-pcrphase-sysinit.service and systemd-pcrphase-initrd.service) is a specialized boot daemon responsible for measuring the boot phase into a Trusted Platform Module (TPM2) Platform Configuration Register (PCR). Specifically, it extends PCR 11 at various milestones during the boot process (e.g., leaving the initrd, finishing sysinit, reaching the target). While essential for highly secure environments utilizing advanced TPM policies (such as tying disk decryption exclusively to specific phases of the boot process), this service introduces unnecessary computational overhead, potential TPM communication timeouts, and boot delays in standard environments, virtual machines, or deployments that do not utilize TPM-backed Measured Boot.
This guide explains how to completely disable the systemd-pcrphase service in Ubuntu Server, enforcing an absolute block on TPM boot phase measurements and optimizing the boot sequence for standard infrastructure.
Stop and Mask the systemd-pcrphase Services
Because systemd-pcrphase consists of multiple units executed at highly specific, early stages of the boot sequence (often deeply embedded in sysinit.target and the initramfs), a simple systemctl disable is fundamentally insufficient. To guarantee the init system is physically prevented from executing these TPM measurement binaries under any circumstances, we must explicitly mask all associated units.
- Log into your Ubuntu Server via SSH using an account with
sudoprivileges. - Stop the services to clear any active processes (though they generally only run momentarily during state transitions):
sudo systemctl stop systemd-pcrphase.service systemd-pcrphase-sysinit.service systemd-pcrphase-initrd.service - For absolute certainty, explicitly mask all related service units. This symlinks the unit files to
/dev/null, creating a hard cryptographic block against them being invoked dynamically during the startup sequence:sudo systemctl mask systemd-pcrphase.service systemd-pcrphase-sysinit.service systemd-pcrphase-initrd.service - Because the initrd phase service executes before the root filesystem is mounted, you must update the initramfs to ensure the masked state is respected during the earliest boot phases:
sudo update-initramfs -u
Verify the Service Lockdown
By masking the services and updating the initramfs, you guarantee that systemd will completely bypass TPM PCR 11 measurements, streamlining the boot phase on systems without Measured Boot requirements.
To verify the lockdown is successful, attempt to start the primary service manually:
sudo systemctl start systemd-pcrphase.serviceSystemd will return a fatal error stating that the unit is masked (e.g., Failed to start systemd-pcrphase.service: Unit systemd-pcrphase.service is masked). Furthermore, running systemctl status systemd-pcrphase.service will show the service state as masked, confirming the complete neutralization of the TPM phase measurement daemons.